From nobody Sat Sep 26 13:47:01 2026 Received: from sonic314-27.consmr.mail.ne1.yahoo.com (sonic314-27.consmr.mail.ne1.yahoo.com [66.163.189.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C7193BB9F5 for ; Mon, 31 Aug 2026 22:48:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.153 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216504; cv=none; b=Neeseohv8cnVprXZW01oLoPX9agFKQdRXvcRbi3MAqjHL7340/MIAPF/mrW4clVJ+nv/WQH6wqyd+nionhAtEKY2FjXMUltsHVwaVElfokpBRKGBQ17JgMxBPcRtleF1O8MMAYMAUWDLy/EWxmxYsLe8IWmkLb2WUl/3s+t8z50= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216504; c=relaxed/simple; bh=YePZ51dlYmZ/cucTyw+gosn8F7f35BMcwjmeoZtY7Bw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LU23Wz3dW51XA7+xWljeko2QtMClUJngs6bVmfpit8AtcvSMS4I98aR76Kp2G86394Y2TKIJ74lbi6SQfTBODWlmsxuQWFPFuR/9hOMOhjS4mnX20v7qtCooClcr8Ns8fRZwoIJb6RFeuocfrkSFnBiKQ0URk8oAwPMZjIertAs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=VVK4Chtt; arc=none smtp.client-ip=66.163.189.153 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="VVK4Chtt" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216501; bh=yHlrmN78oxAAQbX+BTQB5IQgb1bzCbKp9XLNwOjJhUs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=VVK4ChttkjF578FRREwpjOFf+VjqJVsv0qnniq7yCCb+WZPCF4xM7NuSQVtodqaBZHDK4qA0G6svdAAKmnUCkH7HVXeUbk2dK0LRBN3BDpO2qSRNZTr1q5p+BhVals7okAcHmFSdBLUCssBudA/kMLB/WgNx3HhEG78SnrmRktGwafavyJGBCZJUtxteNsXV1yHJiTfsqfqlHzLH2fHeaf7513w2aQXxMhAYbsT6jUYJYtDUEAh5TXpx3zMQG1UjAM+tAktAT6A5JJv+H0jrSkfiVLvykX/ngvKhbt6KA7HTA93TE34Q9K7Q5qVpap022d8vOMC7Z8kUdKIrlaEbog== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216501; bh=bkFtoADIFg5rqyzLIe1Cwue9iwORGQCOkM2e84AoNsG=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=T4VbG4TPalGak0aKHwnU44n3zvYYHiCKh0JQpL4RXcEKOMHTkEGJoPub8RDpPWgzu/IKfmVYGZITwmc2eb2ZvkblH1ATvbu4DPVheDdKHxJVTZ/Y9l67mHpcNAy+YAw8SJWyVsYvidn3TZNHqVBLpMCeqCgg1wKCV3zkJyF6KX0IpM9uIS1HltJpdYbM4Sy1d+aH2RDDCydeZWPvJXIsgP8RMoQr+IORxrhba8Tl0s8jqBYLE4zzEW8ZueKiIF7Jb8X2cjYH99ZLGbuFmCMjjIeRb3TQsCRiEv+SGe5Y6zMi6jkMNmEYFuVo6Dkv6iIJk18iyE2at9GIXiJo+jl8EA== X-YMail-OSG: wkr1C6gVM1kY1wwk9eGxXd0VD2TzsIQPmYa4pt.AdCUxBSOgguKzbdXHZ1WZ0.6 vcph3cb1d8AKu6soB4PLnJQ4MJv3uVnYDt6Svlqy06fi3sNEJg_o8qcTWlFgM.EXp7d6ewL_0epA .Zw5NkQ52bIQxFEA0Vff3X471.Zd0Orr7FlXMsGtv5sITzkTJ9RwUY1614vSkpN5Mmt0fliYcSdT CBwJlp7okGTvZ6cDonjA7K5nBQmYVXtfEHBgjH6VhKZVgImrk5HNHn6f.o8zdm_k49XLS5hW.dT0 xz8LNfjpccV22pG66zCnEkfM7_4gNVhTNWJKPymPAzRIFCiWIeN8jJETvgVQIfcD0WqxUcMeOzTU BqtlqYBT_Ck_TQkuAPzCD7SDq9khQGq0hFOZki4Q3e7tNpm8o_uvhppAoJtRd3.CeVS62CGyDV_x MME_ASqUIqASRlH5JShfj00TfLXCHTrqDcThZ8xsxmr7fSfki7SL3lLCb1VYEqF_8M6vWZrE0XQr _qYunTAYErgJ2tULZxlZWo6qKrvqqGbKyKCTuTApROKJXZK.A_U9KWjgadVwSseICj2vUHNr3jfo stBpXGYT83zObGC8kLgyFOmbPdRMogjqMW_AN8tCMi53otsnyU5OUeaCnYPsjnCm7xQw6dSiFWUR Dpa6G9O9RsU1dDo9oVmg.CXAbO8npZBXVOL6LuOOtin5d2CBoIsEih31b3ox9fEM3vU8k7RKURrl pwIcbMGtcvq2Zg5jWlP6AViYV6_wIforel31rJaF7HXdKiJnXaWxxmhU3CNBZvpI4g8Fd6sRpEHA pr1k13FD.I13AAVtahKPlqFYez0.9HViFzfr1vCzKUlDG_cjSw0g1yZuO6RrUkJMPCmYz0MvU8Zx YqqOKLFp1NoW5M5XzXrywWMm.TIYHF0Js_nMJIQyZThvS4RKy7yjG8uprkM1as6kqKZQRU72Q6Tf m_0cYaJhvGgxojlen8d_wWbjeV8E0Ltuv4Dc.KoBhmDnYm3coqpcJsKYty0qck9XCS.v_mefS7Ib Hp.vAY6anLZAH7HBXxzBg5uEyUlLPW607zs6dkNdEbEixEpCioLVAVNxViYQozHBUvuuzY35lqW7 UNh68PJNyOpmyu649LQDeTu7O_xaNC694gVWzgEJRtZM3hrUWVFpMZvMEBudP1HUziJlwC6nsS8D AozfVbCWUsU4uzU7ggpY6iQaDo7fDe7hAOC.wqZn_UwiftQYIqy.eo0Ed8UCD3kZAq_oTRlNi2cg L_46Cn.6UCGGkSviokUQVyufBy0Fau5A4LStfMqx1YUuvfw4Vuts5U_wYx4f.h7dSxTk3OxiQhCs j3zTsqahEK_FbQ_hWAvVV7_VAs34Oe6YsxsoszEZfhQvbjRlkJPSMU7lJkm5kS430xl2HcTSg3KC HUdBuBY2lCjJr92trnMXeLqwq3c76zes1e8D1tueQ9vq2qMvuEBa3gpmwdtoCLwoKr9IqyLlaeKe hor0VWx5WcZFJ_KoCST3bpeUhMfMD.Beiamm_ssbyAjzDwkiPgvDRiJ9CPy9r4hdPUq8JhaSvwun wowSwpq19M6Zim8FfFsbyazRPx7DCfO.8QpZTdr.oo7wEyTGs7diW3lqWGwKsPetHTIyIRfRa1yR G7G6wolWbiS58o4nOgYzoXt8MmKGyunFmzBCKbK2Er5mD5d3abPaPQvrsaF5OJAjSYraUNabNiYZ Jd..J3vlnbx3Xl_GoqqpEh_ra_7zYVUECqVYJUZUffVFr.hs7rWOJtuIwv7TRkOAmW8B8W5CpXak M3WGug32LVZthTwNzIhdzBHvpAHmZ08bfMRjXgWV0O6Z7V8w.Tv2HAsKSSvae_sm6razGAbgb6we 7plnSTP6Aad3tpBTp7RDK1nXTq9Xj_D.tNrfF2zv8.MZPwu36sQytXyv7nL3nkUAvftOGpWL7ow5 XANumG9_9eCV76I8gEBy2YlXqiAiTHFjQRlIUbGxo5HrmePAxxIM.L.QnzW7DYr5sr4D_JgiiND_ fmHz5pWJzbyLCRbFcaggSBShAR5.cALhakzYQ_3Pvh9pXYYalyRS2A4n5QOm2iN8x6rgo.p88Rq_ ZIDiHEyC0VUIoO4r4CUd4ZCcb7ugPV8LM9IF85Ek9u9jLxCLGzLEqwxsp17INiwQpf7KcLxOX1Xn n1Z_YehxdWSV_i3pV_UAAIA01dVv_C3tdD3umrWUvgAW3E64vQDq7fYzVWkQ0DJlbId9yaCAD308 ZINFg4L4iI1CpJNZr92bsGiRHOXbRsxpEGgnMJi8EtzAxgrtgXO9Vo7OC3eRW2pBmoIaxA4gPH3I _hbiVM6P.YEntmJJwTexB4CZt X-Sonic-MF: X-Sonic-ID: 194f1d79-40cb-4ef1-811f-9399768b077c Received: from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.ne1.yahoo.com with HTTP; Mon, 31 Aug 2026 22:48:21 +0000 Received: by hermes--production-gq1-678d9dd684-vr75x (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 9afda7e456c775b6473ef75f34d3e2be; Mon, 31 Aug 2026 22:38:01 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 1/7] net, smack: Create a function to set secmarks Date: Mon, 31 Aug 2026 15:37:42 -0700 Message-ID: <20260831223748.4304-2-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831223748.4304-1-casey@schaufler-ca.com> References: <20260831223748.4304-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Rather than open coding assignments to skb->secmark, use a helper function secxa_set_secmark(). This allows for a case where assigning a secmark is more complex than a simple assignment. The version of the function here does the legacy simple assignment. Change the functions that currently assign values to skb->secmark to use this function. Signed-off-by: Casey Schaufler --- include/linux/lsm_secxa.h | 28 ++++++++++++++++++++++++++++ net/netfilter/nft_meta.c | 5 +++-- net/netfilter/xt_CONNSECMARK.c | 3 ++- net/netfilter/xt_SECMARK.c | 3 ++- security/smack/smack_netfilter.c | 3 ++- 5 files changed, 37 insertions(+), 5 deletions(-) create mode 100644 include/linux/lsm_secxa.h diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h new file mode 100644 index 000000000000..926257d4730c --- /dev/null +++ b/include/linux/lsm_secxa.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +/* + * Copyright (C) 2026 Casey Schaufler + */ + +#ifndef __LINUX_LSM_SECXA_H +#define __LINUX_LSM_SECXA_H + +#ifdef CONFIG_NETWORK_SECMARK + +#include +#include + +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ + skb->secmark =3D secxa; +} +#else /* CONFIG_NETWORK_SECMARK */ + +struct sk_buff; + +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ +} +#endif /* CONFIG_NETWORK_SECMARK */ + +#endif /* __LINUX_LSM_SECXA_H */ diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 0a43e0787a68..bd0f7a0931f4 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include #include @@ -502,7 +503,7 @@ void nft_meta_set_eval(const struct nft_expr *expr, break; #ifdef CONFIG_NETWORK_SECMARK case NFT_META_SECMARK: - skb->secmark =3D value; + secxa_set_secmark(skb, value); break; #endif default: @@ -950,7 +951,7 @@ static void nft_secmark_obj_eval(struct nft_object *obj= , struct nft_regs *regs, const struct nft_secmark *priv =3D nft_obj_data(obj); struct sk_buff *skb =3D pkt->skb; =20 - skb->secmark =3D priv->secid; + secxa_set_secmark(skb, priv->secid); } =20 static int nft_secmark_obj_init(const struct nft_ctx *ctx, diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c index 1494b3ee30e1..9d799d2459dc 100644 --- a/net/netfilter/xt_CONNSECMARK.c +++ b/net/netfilter/xt_CONNSECMARK.c @@ -14,6 +14,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -55,7 +56,7 @@ static void secmark_restore(struct sk_buff *skb) =20 ct =3D nf_ct_get(skb, &ctinfo); if (ct && ct->secmark) - skb->secmark =3D ct->secmark; + secxa_set_secmark(skb, ct->secmark); } } =20 diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index 5bc5ea505eb9..ea67aa92ddc2 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -11,6 +11,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -36,7 +37,7 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark_t= arget_info_v1 *info) BUG(); } =20 - skb->secmark =3D secmark; + secxa_set_secmark(skb, secmark); return XT_CONTINUE; } =20 diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfil= ter.c index 17ba578b1308..b363c42f252e 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include "smack.h" @@ -29,7 +30,7 @@ static unsigned int smack_ip_output(void *priv, if (sk) { ssp =3D smack_sock(sk); skp =3D ssp->smk_out; - skb->secmark =3D skp->smk_secid; + secxa_set_secmark(skb, skp->smk_secid); } =20 return NF_ACCEPT; --=20 2.54.0 From nobody Sat Sep 26 13:47:01 2026 Received: from sonic307-16.consmr.mail.ne1.yahoo.com (sonic307-16.consmr.mail.ne1.yahoo.com [66.163.190.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22ED03C1D43 for ; Mon, 31 Aug 2026 22:58:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.190.39 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788217127; cv=none; b=QKzy23LnFGjsZgFKaE757hlbOfCh+PZ5WjgzuR1rVYMDz8RBGMQ5CJbCe3NkExg+6DM3hCr0ntzX1roxqFU3gOZniPKN013IfBNOTocjuyKzBm0BpK13znnoQYNSEdStHsdKuMSpvJ+rDD5i/VYhuCD7008BX8rNqCXVwRbwJyw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788217127; c=relaxed/simple; bh=bcsih4BP082rlDrqXJcE7iTam1hxh1NuNkNWgcTrHLs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RBAYAak0oPuIa+ed/b+q8o8740XFSiP628afzuqW2HUUTuKCnX/uDysFVB1r4m864+8ctVKS3j7NQBtPgK9trN3GIO+5C5SN0o2xBe6mhvDyretFrrYKObNEc+Yfs5LUxRLgklWlRGMwAFSqzRw24T6B9A4tuKiay7etfwWZH7I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=s7vPZPtI; arc=none smtp.client-ip=66.163.190.39 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="s7vPZPtI" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788217125; bh=zAA4p9HWXZaBkM7aUTYtkxbtIbeYO06Idd07zx5BtSk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=s7vPZPtI4GuPtgkBQjRtd+maKg0Uyh+WaqYdfggHAjrkIFE7pTLW8lto1gB3qAHgqvbQrg1jAOR1k+b2raBrzavXBppbj7V56+mup8sHugGpp0wZSYlccLiBk3XTy7z82zWCcvv8M7LMFoujnkKtoXIMOWYadzyFjI7LcONFnwmpnj30ni8QjAewjogoS9OJGWbEKoSDzEEg5nViCNO3R+Ka4utxtBynjilre/Syd0zD6LqAt/TrbZec69+5jurKZ0Kq64ALFWu/cZ3psjqzpqO7+Ew/TVnAQmyHVWCIOdfixbtk8mwLlTY+HIDEIHKZvEgGkwLxMr5diDTK4FWtQg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788217125; bh=eikqfOZJTia9IMtxM9M0+qAh8R7QoSScDxEB9tIHycU=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=Fa9yCEJ0LPMSmgTpcT53xwvEmOI/gBuqdu1jn80tXyqBvQFcSgjERKPwhb2EnKTx+qSjPbOIcgVtk02lDII3e2bKeCZUTHRSRw+v7QfnvG3YUXCzzHzS9e3Y3nFY3WdxoGgRVm8aR6ZQCkFb2369XN/Smlxu2OSd80rnMK/n9MwCOrBwqCwh8X8C0kJtqsc32siWKtSDi7enUKnWyIS1lmHdNRO7RGG92XJsLjqHERWAowrBLe4dYTX1PICgZ110jheih3msHEkeoNxlsiYOZ6wjWiUtp5AQby/zmL1a+9H9ocaFlGPXsmgipTTL+KAvxlwN2bRrrlo3cCqj8Lgwrw== X-YMail-OSG: QOx3Zw8VM1k.P0Yr4C9fK4ehm8UpkJfD.O1V7iassadsfNj2Aykv1hQfa05djml HBhTrimuZ9sdmuj1VNKE.tq7TybtuxYfRQqSN8l_sy7XHR9Zv2EJIuR1jfKJQIz_W8LqLzHpRs53 ckEsVgMmDYn69oPtT1C0Fn8ETuNOs1HLYxWwO8lktY1Jb2JlrUOOeY1m9U_NULshRgECKQx74JJl nSRlcDUs9v_cug7S46sHLR6CT5JRYyD.5oVOjSus.144DHIJBMcQOIjpzD8191vtQuz1DB7rT80R 44t4tJ0UAvyB4bs9o8jpdh.1sHKnOOis826GTR1Ui0lKk3oYuPu5hSAZh_NSBoJRI8hGIHnDiS9q qczlOBtkvYRtG1WhFv9zFhvcjWhpUKxRJos3jLz5FuLXQ8J9_FYnpeXvQzZvT2HJW7tMbPx8fWhG bNmnVNyD88TQPzXrt9MQ_xe6Dt9zZEeBQbJe41.tFtMLYZ2yecQcwHzVGMKGyoiS6h29IDkeP4Rf gzhUo7v_skCrWK0E.acG293EeDeH0CBEt6kD4fky9RHTPJiHI2kklUxISFSyDSvKxEZCsMn39ucW 9fvjSYdgw0YxIC60r.aOPeHQ3ASnSc3rivliB_bTxeoEkSCYfnIHOjxcjpwaWQFvfuXKow.9kjcF ioGvvSK8MVQyPuXCXdEIRDTR88YHqj5n_2SFajA0Kbyi6nQ.BbBN5sb3o.GUXBIdeGCkbZnXKlzJ WJWGlRPDIFaeMs.5G2wwkDLiwD3a5AanMPGdRuuaRTIc.SRe8dLsr_knDTLTzf3Z1nCBIlwppqsP 2uXH4kgIIgwW0.ylzCdl9b8HhYf2WCaw.Dnhl09csqHdR.3o7s5DOce7WLW9Sis9aWSX1oQKco6. e3asJJBl3AHoObQ.VrWAJW9s00KOitBxrVCubdm4afaK2egLKRSVOmwF3v1egqXDYIHcM629t6gM 57pKD58UHkL9EZWNxusJeQFbS4S7lNlzi8Q7HahA7DZQzp2LDQF1G037GShquMrxXhvmz3Tx8Ip2 osRNgrURQrGBI7vSwlgILjRZ1qLDuF5KOoC7qwjhiqZ9inm8.ltKob.67y.xYcMFhyVhAUY93TM9 9i42BFw5UuUWHKei_mwuEIgqrVi4SP.rddvo9LKvScgecZG2fggn4msx7D9HpTw21WJ8mg9WY0G2 C3ER3fAJOWUk8OIEzOAc1LIcwsALukPL0yh3uah2oFfm2EsvE1R4EQpUBzAvm0sR3ShctBMPWMqk wIKE.UeOdGk3dnsIh_SsyWATC2XMZ0XowA9Le7Z5xZ8gumdw8cLby9eUq35vD2p99KqB4fiopxS5 lNTx0YNta6.mIcLYAb.Mx8hzFct6vFml8rWezfeK87V1OgdQxcUzboBQtbPSf0yVytHJ6zI1t10_ pTtCsxGFdxA9NznVE95PkQCw9w2po8hBLXtupUjCn6Z7H0Um724nFMldJ_uGv3nBIMAzSoXUoJgs Lg1Sg4vkvyvsnm32wnYqBhMY9Db2exwsHUawiB.ADYK15pXXG5KQSPKWDz0inf9.3WRyO2LARKNn Qw0KYmNc5ayMI5OS9Wqm93LNHBrMarIXw0p7UkYNHTt.eMEQiyVCwQ79oMVgrJmcyUhvIP3QgfrN Q7rnSh7sZ66P8c1x_8.Q4it9hJW05DpIfGAZqD2.OFD6p2h3c3DXev5hW.SIRih7pL0wUE.ayHiX ZmIek7agczv05770U4JEMTPzv6TbASm.X255N64nlzIva.8lQL8LJvthGPVaLO8lDgrHLsIJokPU z76aE3KK8sL8tyZcLffKE_sWktY6pKJ3AFQEysqez41l4ytq87fi5RX2zddAYXwREkmAV__aSJ9I G3aiWcCIjhBHuNSJp1J3Y1HZp7Axnw9Akpt8HLxyaLmq1ijcErJ7maXB3ipkRruH0o1xkBJBVf7O d134gV_yLR_6JD1pbv7WNhX2P1Z8yb2GPBRkF1Qg3auN1KN458.5bdEBFBv1_APlKcjBH5pRKrkG 2aR.gf3aFM5GBi6aodM5afNd6vAphcMwxI1yh3h2ZXC6udKuoFU1UCF_gpGLgwFIdGl7CzfFxJ16 5aaixVHYJR6B6Izj0aK_ooikCopjaYmtFQaVHyr6opWkbyiTBMkMkRqO635GnEe4YJiNbBn_GeND uZ0aTmwF2QJZJe2Q9yrng1Bb93dEu0_zoDJ7zuyzxsM0o4ufxX_grZ9Nis4Xq9wUS122Lpqbz7qJ UrnPl7ar437_UHsb4U_KuXtj1DhFfq9w4q3U7G2dKb2eLvtgOlzjPoTGBRx5vWh1RrbkIyKApYxa 9tshQUqWiGBO.E2T_Ihe_jb5_xII- X-Sonic-MF: X-Sonic-ID: 8c0ff2ea-88b5-4ec1-bcd0-193f0bc1706d Received: from sonic.gate.mail.ne1.yahoo.com by sonic307.consmr.mail.ne1.yahoo.com with HTTP; Mon, 31 Aug 2026 22:58:45 +0000 Received: by hermes--production-gq1-678d9dd684-vr75x (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 9afda7e456c775b6473ef75f34d3e2be; Mon, 31 Aug 2026 22:38:03 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 2/7] LSM: Implement x array functions for secmarks Date: Mon, 31 Aug 2026 15:37:43 -0700 Message-ID: <20260831223748.4304-3-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831223748.4304-1-casey@schaufler-ca.com> References: <20260831223748.4304-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement, but don't use (yet) the functions required to use xarray indexes in secmarks. Signed-off-by: Casey Schaufler --- include/linux/lsm_secxa.h | 19 ++++--- security/Makefile | 1 + security/lsm_secxa.c | 105 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 117 insertions(+), 8 deletions(-) create mode 100644 security/lsm_secxa.c diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h index 926257d4730c..569c7f242b78 100644 --- a/include/linux/lsm_secxa.h +++ b/include/linux/lsm_secxa.h @@ -7,19 +7,22 @@ #ifndef __LINUX_LSM_SECXA_H #define __LINUX_LSM_SECXA_H =20 -#ifdef CONFIG_NETWORK_SECMARK +#ifdef CONFIG_SECURITY =20 -#include -#include +struct lsm_prop; =20 -static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) -{ - skb->secmark =3D secxa; -} -#else /* CONFIG_NETWORK_SECMARK */ +int secxa_from_lsmprop(struct lsm_prop *prop, u32 *secxa); +int secxa_get_lsmprop(struct lsm_prop **pro, u32 secxa); + +#endif /* CONFIG_SECURITY */ + +#ifdef CONFIG_NETWORK_SECMARK =20 struct sk_buff; =20 +void secxa_set_secmark(struct sk_buff *skb, u32 secxa); +#else /* CONFIG_NETWORK_SECMARK */ + static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa) { } diff --git a/security/Makefile b/security/Makefile index 4601230ba442..e93be00bb6ae 100644 --- a/security/Makefile +++ b/security/Makefile @@ -8,6 +8,7 @@ obj-$(CONFIG_KEYS) +=3D keys/ # always enable default capabilities obj-y +=3D commoncap.o obj-$(CONFIG_SECURITY) +=3D lsm_syscalls.o +obj-$(CONFIG_NETWORK_SECMARK) +=3D lsm_secxa.o obj-$(CONFIG_MMU) +=3D min_addr.o =20 # Object file lists diff --git a/security/lsm_secxa.c b/security/lsm_secxa.c new file mode 100644 index 000000000000..50ce613e35c0 --- /dev/null +++ b/security/lsm_secxa.c @@ -0,0 +1,105 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +/* + * Implement functions supporting an x array for LSM properties. + * + * Copyright (C) 2026 Casey Schaufler + */ +#define pr_fmt(fmt) "secxa: "fmt + +#include +#include +#include +#include +#include + +/* + * An Xarray of lsm_prop structures. + */ +struct xarray secxa_xa; + +/** + * secxa_init - initialize the xarry of lsm_prop structures. + */ +static int __init secxa_init(void) +{ + xa_init_flags(&secxa_xa, XA_FLAGS_ALLOC1 | XA_FLAGS_LOCK_BH); + + return 0; +} +core_initcall(secxa_init); + +/** + * secxa_get_lsmprop - get the lsm_prop associated with a secxa + * @pro: destination for the lsm_prop pointer + * @secxa: index to look up + * + * Find the lsm_prop associated with @secxa and place a pointer + * to it in @pro. + * + * Returns 0, or -EINVAL if the mapping can't be found. + */ +int secxa_get_lsmprop(struct lsm_prop **pro, u32 secxa) +{ + struct lsm_prop *lp; + + if (!secxa) + return -EINVAL; + + lp =3D xa_load(&secxa_xa, secxa); + if (!lp) + return -EINVAL; + + *pro =3D lp; + return 0; +} +EXPORT_SYMBOL(secxa_get_lsmprop); + +/** + * secxa_from_lsmprop - get the secxa associated with a lsm_prop + * @prop: lsm_prop pointer CBS * @secxa: result + * + * Find the secxa associated with @prop. If there is none, create it. + * + * Returns 0, or an error if the mapping cannot be created + */ +int secxa_from_lsmprop(struct lsm_prop *prop, u32 *secxa) +{ + struct lsm_prop *lp; + unsigned long il; + u32 index =3D 0; + int rc; + + xa_for_each(&secxa_xa, il, lp) { + if (!memcmp(prop, lp, sizeof(*prop))) { + *secxa =3D il; return 0; CBS } + } + + lp =3D kzalloc(sizeof(*lp), GFP_ATOMIC); + if (!lp) + return -ENOMEM; + *lp =3D *prop; + + rc =3D xa_alloc_bh(&secxa_xa, &index, lp, xa_limit_31b, GFP_ATOMIC); + if (rc) { + kfree(lp); + return -EINVAL; + } + + *secxa =3D index; return 0; CBS +} +EXPORT_SYMBOL(secxa_from_lsmprop); + +/** + * secxa_set_secmark - add LSM information to a secmark + * @skb: buffer with the secmark + * @secxa: index of the information to add + * + * If the secmark in @skb is not set, set it to @secxa. + */ +void secxa_set_secmark(struct sk_buff *skb, u32 secxa) +{ + if (!skb->secmark) + skb->secmark =3D secxa; +} +EXPORT_SYMBOL(secxa_set_secmark); --=20 2.54.0 From nobody Sat Sep 26 13:47:01 2026 Received: from sonic312-30.consmr.mail.ne1.yahoo.com (sonic312-30.consmr.mail.ne1.yahoo.com [66.163.191.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 529EF3C09F2 for ; Mon, 31 Aug 2026 22:48:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.191.211 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216504; cv=none; b=Oy5UZOOvB+lXGPYgm+VMKwSkvhpfDzVDgjJMpn1VuNyehDaid7uEoRGyjnlhTRvyxoXoNn9Jn+4MjQSt+CJjdGu/tJ9ov2hU4um3EtBWnH7u5vSKThO2JcxJDmNjdefA1oGkhzLzYLXh2vo3o7gPwMqhvraY3IDnsnXRdo532Kg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216504; c=relaxed/simple; bh=XVSjcaZyuUD2SrbqN9FUXg2GXtPt/4t566caTuPgIpQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=El7LHte+pRWWwhlySJDq4/ELUViHSPIlL3H/qGqYujkPhRaOog3QR3OLLND/eYYf5FHzPjY3HflE5pBuGn2ik5LxM061+OPYcojWdY9/aN+yT+Mu/p7ENuFfstF8Fo8B8gh/5y6Y66Oi4MCLbT2QSMo9VCdTzrAzY5FBvdrfFVY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=JG9c8kog; arc=none smtp.client-ip=66.163.191.211 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="JG9c8kog" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216501; bh=tLRp/oU1oiSOD4+KZUJnxFQDz8wkKZs/J7I1da4eUx0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=JG9c8kogUJT6zz5KKprXcCdcObTNQFdiKyN04nShXKcOIgXnfFjeVLe0JpZCREjPoRwPoqnHnBfugFVvfXqLaCt3dqg7zqDVlqf2K4Kw0tiI5BOak7GsqZiKIUlcNXrov+VKl/mNsx31Krxi5zEIw5y+4pjRSqDnoSZiMwj7NQq2d0kKizw5QMMDzSfTP1U8t3Kl/vkqPHJaKo6O9bYXkXv9aIng+9S5iZ1QOTFXt4zUDPZbwdnZk++akmMmQMLXPalVbuGTwfTiaMAITYgsgNhCxkhZVIEoSYwOM+PkMofbvwv/FRv92a8ewxPfSXnMAmwHuen5XCPnI/CkFDGAxg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216501; bh=kjMZpGvLEEQLHM0X30NZQ7D3EvBe7holCbozckKjy5q=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=PKMjG0KyjtTxt9VslzZcAY5Yhouz2f1gfsiLQKtK+y59aaahs1fwEOlvrehycZNKtoPUq7+KZRmuHxah7MzDYd0d4KGFoNJir3uBpXVSAdX6UStTWs6SeO1xCDg1Q3FRH2dPVSqw5/IkGeUFG5pH0Yc4g+6zoepbE4tbUC6oHhqUZTUINnbKYKcP+v8E/QB4+2AHGDWiNXNwTDF+oi3+QOteXdHsYJqRLHVBB/17EpiWXujTY8ICC2jAsIyqU81g2NqH0MZo8RYXmvIc4khyHCsn2E/2A139PYxNUMnov9UaApopVK3V7rCQ/uztnxV8kyrmg7lRKAgdN48Yfnl0IQ== X-YMail-OSG: r4mSwyAVM1l0GdCNgnHvnP9wSKs0gd0UY9Ts5o6sEt3lJS3fIkPMmzhivF7eCfF dPGVSHMoNe3TfbSI2FKmQmNLv0VG5VC2_qnL1wBwuQl_tDgAmahK9xnc3TS9e9v6K5eS6ZCdt28k qTgebUj4zdl1zXsvepfLzTiRfqmTqC2vGjMgxxSpD73NMB7A7Avlal4dI0kOm7M9YYYierwaCuja 8x0ma9qlpc7W_TxP757pL6uCRBIawnuobVKMALhxcIk968lwAXh9dbmhlngNqyDWF.nm1kSr6obW 33TTdrL96mSFz04pWjFId_hPPlChBaL6fsCYzpYhleAZIEv9p91YqOwr_02C.XfqMGn65j_eFOxx iW0BIEA56pIQf2KfrqxYUkEfZ.I0cY9utIyTTFzLZoIFD80LKqBCNvusRX946eCMjx_Sg37XYZLH Dsts3qRNz2pJi9.Yhe1SYqrBvVdju0KQzdGZ7BIOmUaE8Cx2amy_FFPg17JjyTjbLgALxSgdouHY nVNn7ixIgR_26ziepY25k0ZAl2beCrun99TRfymhDEWvrAUJpf28lCXsqvP1ljXXp4Slh4_jQ7fs BxkN6l_y8yVmY9mI9bt.K5LPZj4mjFrPw1q0jYDn4Q1zlj74oQqBjNDRffK3TBY75WYH_ZNvBxG2 vrAJtuR3ivYfDNASdExRhGyNYjc1JOuWZEhxxFrYeJvUjBu3heGAd.jcFVHwtrw_TDy26NkisrHd o4bZ07lOzQ6rhF527PFvdyozmIOPiHX.H0C64oLI_kJJbnebcxtyk9jVWf8v9bsN_RFT0GrsW0qQ dA57n.ZPV.xPywikhmQt2ok.7gV7G23WzCdD7o2dL2aW_cX6vD27FNwIwpssHfnOQ4et39ekArBx EY4PDNqDfdk.ovoMTMxVV1p80dHy25y2N1WmPOVuSxi0IoNOAUhg6LKBkqhe9fUj9tx6FH7ywYDv IftnHJQkppioRXywiCBsr6bgwgaToCtKU5KATioeQEkYXPmpOe0.pRzU5EdQpeBHb192TejyUOBO 5UJL.dm4hhJi1iaWgFa3nYhLPmaG0jSVfGGKugITVZMgwCR.opmTX.xuk4ChjGvGFQP1Q.03Ulbw MRDWd1UQjnZt0rPCnp43EEYJ1daGuQJ1g7z.83p_C3mziqGYsrbTYxxKE6C9UNbFiwpDVpyXp2Fo 9nKU7tnuFQaCp1nUG7i868oT8i3ZGir5JeI.EDUz6_5.bxbTT6fqmwAK6nB1gscxACYzrDIyxMdO oO9fcO_FrMRhhYXf3zzq2Unn87omu3k3s1BkN_LyIJCS_3ccGtZxJA9Oso4IBza4gPN1j1dFWk1_ CLxVC48_vQ25cOvzmyLulmh_S8xbaghU_iKT4jPD52yYToqZZVfNR5hkgN20oZYmP.nIc_LkacrH F5yMSTgk1w9.51iJ6qPaCXHLT56.8eZ11EWL0S288RIP_avlY8vLyryVTcWl4Jkrw1njAmxRuitN vx1nBoNaqBzpeGdncPICmg5U3d5RdEUWrPH.ORD9y9XQ8Zo2hsxbsFWYg8Bwk0gea7JHXju.ij03 PrlmTZA_IYMtpfNPMs7dddUOJjAkROQUVXdToU1cjR1QOzrmaeyUTPC3ETBQ79y9hw.VZB6ZrHcn MHkirXQThjSLtmnKosOI06qxPluqFtVHqRh0JCl5_G5GtAy0oa9stknF63ReSDndqFqNjxFOhAPX haqGAI2CF3YmFltNFvfDV9Lin7tqoqeGsAeNoo_IAM9AAUFHbGC6P5ioxUDq7tZbiMIPG4UgQsGj PZj6UMXI.edYZWhgBI2aXHt.eg4cnELXmuRZEfxJYlcGs1XCyT.YwegQdp60NA9Hx06ZbFbgg6sB d49_lgZJM7PrqwgWP3ZJCE5v3.S5l1FRUo43GTZ9VXzU7v0btm5biUr3OezqKWg8RjId3f25iAxy SHdHHvIZvcgJOJXCJDp5Cu1_Rpn8xvnrTYALf9IIhg_RSWG6jBcATaUtrkvl7DQgHAJ50HccPXFq 7WIjuhS7j4KsQvNcKOgehaJSvO.mi5XJliuIWA6OtdPTmLBAIc3CLDPvDrSHL4WUWVqpFeRx9wfS 0OQN6w0I017IucBKw2bDg0xf7_M9QgXkJ_dLKFRi47UsdJ13wIQVcTnWTBAwvy1Pih06gT7VmgR9 iZBpiutakD7N2mP_fgj1VRQKjtQ55I53uWttNvAmizON8UZnaApPMZtE2noypWdtDLNPXOe4iFoQ D1ZFaTFl_9PEk2iM83ak_uECZRtaBIjcVlC2SRSVXHPQA9Ngc X-Sonic-MF: X-Sonic-ID: 951b3f9a-4cc0-47df-9489-96d6215cd7ea Received: from sonic.gate.mail.ne1.yahoo.com by sonic312.consmr.mail.ne1.yahoo.com with HTTP; Mon, 31 Aug 2026 22:48:21 +0000 Received: by hermes--production-gq1-678d9dd684-vr75x (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 9afda7e456c775b6473ef75f34d3e2be; Mon, 31 Aug 2026 22:38:04 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 3/7] LSM: Two hooks for manipulating struct lsm_prop Date: Mon, 31 Aug 2026 15:37:44 -0700 Message-ID: <20260831223748.4304-4-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831223748.4304-1-casey@schaufler-ca.com> References: <20260831223748.4304-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" security_update_lsmprop() updates the property of the specified LSM in the @dest structure with that in the @src. security_secctx_to_lsmprop() sets the @prop field associated with the LSM specified to the value of the passed security context. LSM specific implementations of these hooks to follow. Signed-off-by: Casey Schaufler --- include/linux/lsm_hook_defs.h | 4 ++++ include/linux/security.h | 16 ++++++++++++++++ security/security.c | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 52 insertions(+) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 65c9609ec207..679c40a8e127 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -305,7 +305,11 @@ LSM_HOOK(int, 0, ismaclabel, const char *name) LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, struct lsm_context = *cp) LSM_HOOK(int, -EOPNOTSUPP, lsmprop_to_secctx, struct lsm_prop *prop, struct lsm_context *cp) +LSM_HOOK(void, LSM_RET_VOID, update_lsmprop, struct lsm_prop *dest, + struct lsm_prop *src, int lsmid) LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *se= cid) +LSM_HOOK(int, -EINVAL, secctx_to_lsmprop, const char *secdata, u32 seclen, + struct lsm_prop *prop) LSM_HOOK(void, LSM_RET_VOID, release_secctx, struct lsm_context *cp) LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode) LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 c= txlen) diff --git a/include/linux/security.h b/include/linux/security.h index 153e9043058f..19adc19eb9af 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -576,6 +576,11 @@ int security_secid_to_secctx(u32 secid, struct lsm_con= text *cp); int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *= cp, int lsmid); int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); +int security_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop, int lsmid); + +void security_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid); void security_release_secctx(struct lsm_context *cp); void security_inode_invalidate_secctx(struct inode *inode); int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen= ); @@ -1581,6 +1586,11 @@ static inline int security_lsmprop_to_secctx(struct = lsm_prop *prop, return -EOPNOTSUPP; } =20 +static inline void security_update_lsmprop(struct lsm_prop *dest, + struct lsm_prop *src, int lsmid) +{ +} + static inline int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) @@ -1588,6 +1598,12 @@ static inline int security_secctx_to_secid(const cha= r *secdata, return -EOPNOTSUPP; } =20 +static inline int security_secctx_to_lsmprop(const char *secdata, u32 secl= en, + struct lsm_prop *prop, int lsmid) +{ + return -EOPNOTSUPP; +} + static inline void security_release_secctx(struct lsm_context *cp) { } diff --git a/security/security.c b/security/security.c index 71aea8fdf014..1dec0037370b 100644 --- a/security/security.c +++ b/security/security.c @@ -3965,6 +3965,13 @@ int security_lsmprop_to_secctx(struct lsm_prop *prop= , struct lsm_context *cp, } EXPORT_SYMBOL(security_lsmprop_to_secctx); =20 +void security_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid) +{ + call_void_hook(update_lsmprop, dest, src, lsmid); +} +EXPORT_SYMBOL(security_update_lsmprop); + /** * security_secctx_to_secid() - Convert a secctx to a secid * @secdata: secctx @@ -3982,6 +3989,31 @@ int security_secctx_to_secid(const char *secdata, u3= 2 seclen, u32 *secid) } EXPORT_SYMBOL(security_secctx_to_secid); =20 +/** + * security_secctx_to_lsmprop() - Convert a secctx to a lsmprop + * @secdata: secctx + * @seclen: length of secctx + * @prop: prop + * @lsmid: which LSM the context is appropriate to. + * + * Convert security context to an lsmprop. + * + * Return: Returns 0 on success, error on failure. + */ +int security_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop, int lsmid) +{ + struct lsm_static_call *scall; + + lsm_for_each_hook(scall, secctx_to_lsmprop) { + if (lsmid !=3D LSM_ID_UNDEF && lsmid !=3D scall->hl->lsmid->id) + continue; + return scall->hl->hook.secctx_to_lsmprop(secdata, seclen, prop); + } + return LSM_RET_DEFAULT(secctx_to_lsmprop); +} +EXPORT_SYMBOL(security_secctx_to_lsmprop); + /** * security_release_secctx() - Free a secctx buffer * @cp: the security context --=20 2.54.0 From nobody Sat Sep 26 13:47:01 2026 Received: from sonic310-31.consmr.mail.ne1.yahoo.com (sonic310-31.consmr.mail.ne1.yahoo.com [66.163.186.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6DD263B9935 for ; Mon, 31 Aug 2026 22:48:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.186.212 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216503; cv=none; b=Z7TzASoWgCJb5h4OLNi0plv3SOaEUGBUeszdd68aWrQ9tuSP5PFFuk/YKu+24XCqYi14NcmTM8Ax/iKSVh5MHAb8TsgOYF4U/hKVZ06FPocFLNGmv88ds7X2jgGpQlIdgYEoEAAhswSwiYMYGigS/JXdaAPPvZuU9cX/2a5yFaQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216503; c=relaxed/simple; bh=d4zY/ltnmjXjcN3r0DfckvWNHNEg/g2aMa3mQiZA4Cw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=EItqGYzisM7hStR+CefnAHiXN1pF01kiViarNy2f+W+9sOATlakDt0QNanmVNIrhCIAjKjQDVAjqKdKA3jS5yI56ubAdNgrFIFlBmQuj5WOx2NeH4IK6CndkDhTEnwY3aBzhIVSdvlrXcoZZyHxWGgxJztX+ZfRB0ojZDN4LJpY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=TQwMuNuH; arc=none smtp.client-ip=66.163.186.212 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="TQwMuNuH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216500; bh=8t0OQ77yaNOPEWl7EKKJc1q7r/apIJtz5Yj4MAKBYDo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=TQwMuNuH7BPmAnXJRPk465DoX67dgcB7euw7fQXVyBzK+kMVHXBRTXuiAsrGa64SyazD5taWcWZ9B3zwUXMvSG6fXpDlJq7NvyM31r9S8XDixE7IN8kJPqTOoifZGiqj2Jixz1AmpGbGzlRKIdMp2QrpZCcrrTPdrK1lOrzOXMnZIaujzNiCBEQuba4nvt9UEj47LBmeH9t7X8YdCEw2oYUcIqhXD0rvhPbl3zI/3Mm4VspNjOOKG90m180/p61c6Qf98VgzE3u8o62cFZ2M3udpS+muRXYL/JL8thW06RS6E51GsbG76Uz/FaCQZJOLwGMk9eRPghsj4+df4c0jxg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216500; bh=J4mpD8fa3SjtMkOz8PgvEMkB79KFl7uivM9wHVQcT9B=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=MxFzFKslxtwEHNvebLkCXLxg+5RohSCXuwAYK/6xVPJRMj4hxi4e8zE9GFUw7/Vsahb3YOB+eIhohMMtzxJ0ATgAFJ71rD4MjWybx2aL3V5QMvtt5zfF2Zd3RMz0t3sShNbOwheQA2HGt4Ho2bgSMtxgljNqDKsXQxeLFY6/SX12hmEsGSnphNHp9lLmt3HE8+j4CuYVUskyjUZUh+7kBssiQcZu8DLCnaWQQWP+60cq4jsQqGRsMRtkZaS6K9m4EVgljxFa/dOyNlECK5TFvr+4ioCDfTklXbdcCzrwsZ1iPPDWHfdvysrS2aAsFPnNF51Eim69jRP9W21cPiFcrw== X-YMail-OSG: OyWRgiAVM1k7ad.Z8QCLccptmmvye4obIBa61POshNWMZ9s5i.bR73MAhxn27rf JZdzHw1_PYvIQ3H9s9Pw.Rwe08PPgYdc.CsfVVvtw_9Btp0ULafXXzykHz80DQKkya4n.ejKqg7Z wHVyuEpJIiyy29IYmwPxyUja3cD2_ZReQcJUZgwaEdOkkxdHKwGExZK.Qru2RzikARh5_cP.MOoR f5s4MB3IK.rqjzB9.8Tn0yXYNqbBieIGcrwdJk872rURtNQHjpfPTJBIOe3YKw_6oOYfn8qnZHJP ZPzaplw95zKgbLzgPBO58h_MiHmCaTb.RFwcNw0sEyq8uId.eIFooiORlrh1cIPZdPhuCP0dAR_3 _Br2tTuPKc7uk.2.8J8k05drQMtgRJ7ltUR9SGSfm49s4oPuwz6q6we8eBdNoXb_cWMpgn9gHZW0 AzyLTkbjLaIa3mp7miWArIwePP9s6ln_bkOLNUpBYj9fJnZLae3hURBChPqK04bX_jglQJPgdQ1h pSeX5MbpzhuCl8pv.9s4ACrVYbgu8N9mBkSZvWIAxZhYcA521JjCTmuU3t59jm3tXKacWhR6j.xC .XCgTS3zukneOfiUshx4K4OdmrcVkYuoxgSwqgCnqBjRZreECNsnVFFgBBE2ndKZ.6Vko5c9a7TK 8DDWio_Aq.AriUaExJyOJr3ejJ4yRGjim3S09wpwCgwjQvK.4Ai6fdHRU08IXoIFNOUWuXGE5WDg Z0UHu3DPZMp0L5d8Q6tfjuuqyhspuk6nlPul4pons3IzniCHu0c47HvrnJldMZsI3tFx.B6tHzV6 KaviMWg4tOs24OLDTslQm_pFeIVLNyhctQJlAlyb9Vh6iRDrLKcSYMZsZDOFuMOe_vQj.PKDePmx hgJrCT0eQLJMeuyM7W6kdbqy18Sd07BLoCUT0GSnn7OKbsuyt6LZDYxX1RXfuj4BetZdgJ0HxGWy qlVR678AIgTLWnra0.UHDqRhmgZoINKf57wFV3hEr7tF.qsrvMH7ZXe8401jNr.3bpKsPEpFqP.e BhzIxoB9r1LVWRpqsEmd1YqTeG8XMAxya0pRffqktjpZ_WZmOuW8GT7A460Xvdpdjd472GVWzZLd tABtwgunXCAzQqhzsws1BBQXcIgV0I51ykMYs74bp21XYKVYkfYLcBCnZ4WE7fx9pbMqUAGeeXlf X9ywnQvlg_NvcbgfJPcCnT8cdbULcYxV3Pa5INDBI4EIx9DDNyPJrrvX4FVSjvudMCYJ8MajZOx5 mzvvEcqxiTdCOhIOyBjzvgGTGlej6_TcPfO8IDQO4D3Ajx83.srdLi.NZIp1SpTQqIuqy17G7swx _qRshfIPo85t7ugnoesfvcO8aiDhjMignToboaTn_H5A5B7c6vQGJtqrogrHkEhH6kGrhEreBxLd rL7av3pH8J1JMHRgC.IfxyF26JxgPj67bJjCqEkw9WycuttrM9EiDVX8bowMbD0DCQK6TGtdg7WM dCsnmsJlt6Ted7Sl6aW.imev1XdiyFhvWur5IQtPdP1QLm7FoCxaf6ZAwzbPQXgn7yyW_Guq0ie. .YbxDXlRWi2EhyB3fVAAJFdPE_XeSl9KYtxLI2IZhaxa05vxq.6A9aEqJNZ_9Qk1XWaDylvPJgS_ .oyxa4Vpq0TWUXy7Knyax3vLf7VUThffHZTvmv_d4IoPzkihUCR5T0vo4mGndlquKeyhXHyvaVho q.YgyAi4UG2SboIxZdjjDazfjV5tUeCF0GNHelcMY8E3V3IL0b.kJFslysuFB8i5rrjZpEPSyZ1S Tl75CA_epj4Ns27wjfjiIRK2cWk19IAHbIyiYAaFZjpt3kEhVunxZnH.kmaRi6By3hZPuOFME.32 By_6PgdF0y.BfwspqCHLUapjI.3kCAODrD0pt0dCINe6orv2g30G6oMoKxWS7WUtI2kW.6qRx42c 3E1CCTAiA0GsrxxpRXN1u3tq4fGzWbKfOXcnl8Y51wMDFrKkwxEGZ2oiRG30X_n0dNiGn3vbeT_V uQdAad6ZZhNJNja5g_VqFkSuwITW6a_35t2PH6FdeVrRuubv95JsbY.p8pczEf9VK3K9xZwndKde tyhKey.blrkjtL1_9GDbC9OxWIrOs7ZdewgnBxh.zndfsvNfOIt9q8anE1cNoibYmenRyO6PxvQG wh5h7YVuZATCDBWVGY2f_979zlKZpzWOJWixuuAVTJPfC4_o73WQoCj5euRdKpCVpm8TpN4qmI2y _mM7S.OF64N9MPeQjcmG_FPNjS9bOjlofd7M_M.snKC.13Y3CsA0a7KJ76gJGT53xFD8BR2eJoJ5 iA4dvhXUAgILxC7DPlKQjX4Rt X-Sonic-MF: X-Sonic-ID: 4a1df3a9-c7e0-4e3f-a449-ccb131771f0d Received: from sonic.gate.mail.ne1.yahoo.com by sonic310.consmr.mail.ne1.yahoo.com with HTTP; Mon, 31 Aug 2026 22:48:20 +0000 Received: by hermes--production-gq1-678d9dd684-vr75x (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 9afda7e456c775b6473ef75f34d3e2be; Mon, 31 Aug 2026 22:38:05 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 4/7] SELinux: hooks for secctx_to_lsmprop and update_lsmprop Date: Mon, 31 Aug 2026 15:37:45 -0700 Message-ID: <20260831223748.4304-5-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831223748.4304-1-casey@schaufler-ca.com> References: <20260831223748.4304-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/selinux/hooks.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 18dd28b2bb13..12614478b638 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6946,6 +6946,13 @@ static int selinux_ismaclabel(const char *name) return (strcmp(name, XATTR_SELINUX_SUFFIX) =3D=3D 0); } =20 +static void selinux_update_lsmprop(struct lsm_prop *dest, struct lsm_prop = *src, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_SELINUX || lsmid =3D=3D LSM_ID_UNDEF) + dest->selinux.secid =3D src->selinux.secid; +} + static int selinux_secid_to_secctx(u32 secid, struct lsm_context *cp) { u32 seclen; @@ -6964,6 +6971,13 @@ static int selinux_secid_to_secctx(u32 secid, struct= lsm_context *cp) return seclen; } =20 +static int selinux_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + return security_context_to_sid(secdata, seclen, &prop->selinux.secid, + GFP_KERNEL); +} + static int selinux_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp) { @@ -7694,6 +7708,7 @@ static struct security_hook_list selinux_hooks[] __ro= _after_init =3D { =20 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel), LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, selinux_secctx_to_lsmprop), LSM_HOOK_INIT(release_secctx, selinux_release_secctx), LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx), LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx), @@ -7812,6 +7827,7 @@ static struct security_hook_list selinux_hooks[] __ro= _after_init =3D { LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security), LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, selinux_lsmprop_to_secctx), + LSM_HOOK_INIT(update_lsmprop, selinux_update_lsmprop), LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx), LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security), LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security), --=20 2.54.0 From nobody Sat Sep 26 13:47:01 2026 Received: from sonic312-30.consmr.mail.ne1.yahoo.com (sonic312-30.consmr.mail.ne1.yahoo.com [66.163.191.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3080A3C8713 for ; Mon, 31 Aug 2026 22:48:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.191.211 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216506; cv=none; b=P70d6pMjV4JixPeZ1TiW60g0W5t9wtumTRp7rct0Pneza1SQqb1El6CIEewC8IoQO7hLfLc4DE9RznrW0ZuNUeu0T3fhU87FYMw+JaVxpB/0uA+1OEdW+G7mn7QcvGS82Mr+bOTbmx3ufOMW6LV8BfuPneeV+hrr5H5BSJgOD/Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216506; c=relaxed/simple; bh=l5xZJq7SJIQbEKIdMk/8CyU82z95S13RHM4M5HNEOB0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=o+b6Rx3auwlXHCQQqIwoLxScX+gz1Nb19gp9hX5GuwkgohH23rxi795KzlNCYrda0DQgrBELXBvhRHmeSUNqMn1XFjxMd+cYazG/kFzRO1slAAK396E/fC6/mGnWok0hc6OTVY2e4CUa+1moE/TvGdWKHQX0XSp5tBnd69L2QD8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=t5YTfc7O; arc=none smtp.client-ip=66.163.191.211 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="t5YTfc7O" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216504; bh=spL1TCRGv1nTSaQv5qslf2f6hMhi+lllz41KcBPUl+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=t5YTfc7O7kbN48MCCdunVnyDAHRlQ4dTQDnW9lQa9sZ2Mxbyk+bifV0roNFZtVCgopDVg9NAJRvL9cWIbgOJyavABl8YBt58btPbppUrzZh/h34dezDW8+V7nicSaTfbGWfm3xg0qIcimdWtOBEVFsKRU4uy91v9ffHf0o+qYXm2DRbB9DeV3nKZebFM0q9eudsMxTYiqlxoDBW8ouzWMq/xCeke01dUjgEwL2WARJ6YLRI/sSGw+jpXK9e2Kxme/bmxcPtsjmaHSTKeYeB7zcb1RE7jsNJ8Kp53w2rbWLupmsu1SCspLzcBgGQ5DnGGHVUdjQbxf8nT4AgbwzPnzg== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216504; bh=lpBk2JB0B+iSbob8x16wGRkyczj061UjxWyXYrtLKbj=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=lcGd1QJbNCg+WW6p+R8Zn4qOpeCpi9lBTzssSPzzs3dhzllNUN/ZgoBYf8PIIGVFNINU9KtZBzBukgfU82dnJf2i9jdjMG9VlvsPHPXCrwDzPy10DLbsrHrd8BMfvdhO+7Dk9iAn83KGe6fC73lu0CgGSYn/hIGmq42klZFuDRK8NqrF2jL76TvAALijGizQ5KuTqJogcWVR+GLsbfwOfiRwltxSzfz4cFP0mMOSRWGOxfk729Qc5b6uCbcMnP8vd2XLI3EdMIpaOL/2u2KQmq1YdJcsAhf0EwQGU0fUCNgGm+FMhF76ktAJOGH8sZz9T5MEVSOx3T3zqtfl5bm77g== X-YMail-OSG: ZSn2pXEVM1mK5oBxIu.zt1Bip6WyTcdPQTr0dYfx9G93Bn8wyhp8eFSTaGVVs6H 9rs1pt7jNa3VQCY3J2yF90yQ4iIoC5VMTiKTVOWq.zn53quPF5UphUH.6GqWSOgZncyfaQRBWK8t V8My55uDt8L4wfY3MdIGcTrj2y_ycR1dNJCB4DT5qosr5ErRUy_YNVvO2NNC2w7h9tBJtgkV7K0V .LXQeWunRYaNM_Rx55G0yoT7etq94BvutBJ.rNzuzpENO2xEN7L0vYvT71IEATL4wMgG_kFE3KxD n6qMGLD.WxWqJtYqb0ufNB2pSwDDoqWZU3oirbutTDv6J5djgNXfrui46mlHtZXDo0FXRf4NLrlF HEIbqRtP1O4GXF9Va_knUxYV0489PRWeOIDOV3e2GEOItUy6q3wI40VhmKePsoDL6bT7Scu4DQot 2mB7lz5us0witW0amWTXf8FMYx1GgbTXqbGfWnBeixyTXymYMOuNQ2szgzU2XigQ6MHfXU4_E3.d caIXD9duEOH2jWIkg4CMyPxeJO6nvBQdJLpAf0KmTfF9PxVu.JLPYYFTgTOYb6_cl4jnmad_GwEX 6jrMS3tPQIIFiKXCA0TiornCKppwtk8UZWi1RjGf_Ay_c4AiDxwfDP9hak7bEZvH1PhIOYqyt_op UcM.yULD.k8HysO6OJIh5SzNJSAHjcF.Rpq8GQOPeuKCb5ALrK4xapjMvpIVlpIDkPiOt4PI2In5 Nlxy.HGysfM0BlxWP.eK5JD9W4cpUICGrmWRQe9RxEfILbZc4r3QNH4UuiPRXfCkYwO1UkKRndcY qXDryODbJ5CroPL.Or4kWUP5eTc3JSaou129QkaoviTV.zZI4QMq5fxSxP6ffADnc64VvPlr7vUw hRIFzLpQ5J0DE.PnaGazne1qjiHN3Bs9z7kor6PxZL_oTSW4mdbYKoL.WmfMzyPg7fm5d91EOvD4 64nAKCb1Y6YBI0LRXLrNTSjBP7bp32TzFfRRKr82dVlawr.dV3i5S0iYsims9vtOgt2AmOu5zGbR st1eNTBvO_fq1_8K1w4bRx7VF3xM6OJpT3GzKO3422yHOhsVGXxBuRnUQJe8ocDjWNH6jSATCv8F 5iWya3sAEdeQ0J7liAv3SY8dKBW.W1usmubWTR1K7Ukskv7yJTRjrthMiRHCF4_KRw6BmNKOyebU HlkFyp2zO4QGz7nD.ZH9TVlx0k.FcIhcwlwCpKJ6NVi0Wvh0Ypo2YK7ekKlWkb5DJQKs.A7rM8Xx UnP6FJkO91v5d08eYyXVNfaWTfq.nyojowcsuAofVl0t2mOcZ5ei4sNK80ur5tQ5HE92VRuoIN7T 4vYHda4pUbAd9S62JTHsUHdQMmOFcgxey38BOytttJV3sbsZy6dX.EC06CtNrbSiAxqUQX1Zuy02 TYAvIfSRiXTwNm7_9A217.OQTMbLf1kzGHqxX_LmSOp6I6RD.gkY44XKGqzwGo5UK3evSx0BIBVu mz16MjXSnloJ1kx9tkkJobxBTKN6AHf9v9UzRxNkye2PZiFeisQWQGWEFDJxk0ckqyfmIqcytXKy qAudyqSIYoZcGucGaoOmLK6fdS4d7AB4NsriqbNaCN4umEHZ33YYxyiQN5cF.u09oN6loG6sXV0X ghVAZUl1x2vdUYg2KaRpTVJsU1uNz03yUBuqC709qOjHJaYl_kxr.dzSLzH785xC8nSLF1pFcKzY V9XWWZTHeX0JYusu.rHgRPM0QO4EM.KiZomI3lKUsmvNp2uwx_7dLKrKwCHas2GMVugQyhSAed6E HmNwQ5tr5xFMYjhKX.GmKbJ2UEkHRwuRh0PDsTV.Wi97swrCp9FXnN4hPz4O3nKYTECF28qN86e_ aDp.2p8.JBpjDkepv8OEim4p.f4_nAhJFzbspbong7MaM4.NQ6yU.AZO_n4J4aGGsKqsCcb6LUxg .eJ12HElu.a9vHNQ3nqDorwExJwedXNsVoincJI.iZ3LwYiyredTRBg4DzOksAFFlEIMM.t.M58x zw0g_8Qhhh4o6uVDeECcdti_XhmXf0Tx9MtT51.HEZjP80YaAwM_Fr8QJY4FN57UIaP0u2m6Oygi 2iazhxrhxO83xRdslfqJU2MAErmfKdF742iF1QbAGSEXHXdm_4hzvaun91co1kRan_22iIKeo13t ppSyU_PjmpA76Db5I2FoEwn27lfpyy8ygacD2YCx6NONJfZwRonQKZNZ4bOQueWMDCBOcAR0ro1H EA32GCTYwfH63kXc0By5E6uDBUYs1n9pJ2QHSGZX1VBcFW.zS8nWKm0sG61EggB0iOxp2tPvaz5y odARCPRimoiSaO3raC.VVF9_y7Q-- X-Sonic-MF: X-Sonic-ID: a3b693a1-d47f-4dc6-8929-4fb8f8ae304c Received: from sonic.gate.mail.ne1.yahoo.com by sonic312.consmr.mail.ne1.yahoo.com with HTTP; Mon, 31 Aug 2026 22:48:24 +0000 Received: by hermes--production-gq1-678d9dd684-vr75x (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 9afda7e456c775b6473ef75f34d3e2be; Mon, 31 Aug 2026 22:38:06 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 5/7] Smack: hooks for secctx_to_lsmprop and update_lsmprop Date: Mon, 31 Aug 2026 15:37:46 -0700 Message-ID: <20260831223748.4304-6-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831223748.4304-1-casey@schaufler-ca.com> References: <20260831223748.4304-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/smack/smack_lsm.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index ff115068c5c0..fcfadd5d9994 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4909,6 +4909,37 @@ static int smack_lsmprop_to_secctx(struct lsm_prop *= prop, return smack_to_secctx(prop->smack.skp, cp); } =20 +/** + * smack_secctx_to_lsmprop - add the smack label to an lsmprop + * @secdata: smack label + * @seclen: how long label is + * @prop: where to put the result + * + * Exists for audit and networking code. + */ +static int smack_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + prop->smack.skp =3D smk_find_entry(secdata); + + return 0; +} + +/** + * smack_update_lsmprop - set the smack label in an lsmprop + * @dest: destination properties + * @src: source properties + * @lsmid: which LSM is relevant. + * + * Set the Smack entry in the @dest if appropriate. + */ +static void smack_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *s= rc, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_SMACK || lsmid =3D=3D LSM_ID_UNDEF) + dest->smack.skp =3D src->smack.skp; +} + /** * smack_secctx_to_secid - return the secid for a smack label * @secdata: smack label @@ -5269,6 +5300,8 @@ static struct security_hook_list smack_hooks[] __ro_a= fter_init =3D { LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, smack_lsmprop_to_secctx), LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, smack_secctx_to_lsmprop), + LSM_HOOK_INIT(update_lsmprop, smack_update_lsmprop), LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx), LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx), LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx), --=20 2.54.0 From nobody Sat Sep 26 13:47:01 2026 Received: from sonic306-28.consmr.mail.ne1.yahoo.com (sonic306-28.consmr.mail.ne1.yahoo.com [66.163.189.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 583093C1D42 for ; Mon, 31 Aug 2026 22:48:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.90 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216510; cv=none; b=eMQA1GMdt4ohwfLwMpQa8QMFlCOxM636tkJMUcUwTNm5sH03kmtIwOnYEEsu0w1YqCEz0OL0QPzlfS3oHXzMt73JUKKTl1pkWqo9Qdfa5YWAcJZ0iVU1TzR94nEqUDkg9VPIVWRjabydV2jm/fAoldF+m+GW8Ok81Zw8kx44cyg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216510; c=relaxed/simple; bh=muebN+v6qk6ACGUSKBTi0IBPg9qD+4TGpA3UhEWJXTM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hlGi0B8fXaOuj5MKx0OXX+8JDrEW3ETLXvIX/zEwdZIIbfDmxg4fHUEkia6yq+wvMSX8wg+JQWo45YYpva5sGmBLGD3VSA+5rVpz/tYBb7u+BLvjJc/0BHo6S50SSt3PUYKS0JeVsAo3+0WcNO7l/RU5ejgTj/wJs7PVAq/D+6o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=gIoeGgOO; arc=none smtp.client-ip=66.163.189.90 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="gIoeGgOO" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216507; bh=kihgJhG3NGCIZmRbXk8CDq6KsRQabfDfAuGQ1/19lsU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=gIoeGgOOVudWHZP09hNxqu4idnsu2xRYwYeTSqLdXkUBGG8ZmXYLkcNhK8qSv71q0fYvSe1Yp/NBaX6SgM131++a+ghEFLCBO1qy6XxqauqquZOWNBMIbS5e5InUwOCym//Tqa2A4gop7su8yDiilpf5A9eHbwQg6f8XUyzHmsBjFpqyjEG/SiV57il9JtVT458wK78+iujzJrTHzgcoN0+oGni3O+6dulleZulgmW9nK2JRZMcGUyg+AAbN132jgjx07qg77nYaPuCps+ay3IrzIzoy+e2sXBizCiBo3+9vga0oNDmc3GFX3/fV3BM143BQxKUmFWWYzz1gq3AsWw== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216507; bh=/GRAO/sHDl2pzGKE/MXXnQHuZuhDC/GHN7lLh3q4/fS=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=AH722VArzj3tcowYH/rW2sjkNG/Dl41f3GxOyM1AspS8v89YUctPI6ozmCFNBGEYTOCLJq/+DJbC5UCMBQ8gtrW7/S3NSdBHykbVN8CXP/mt9n2i4j18KVVIJ5j30yGfoafKrgw0c5jGlQwFyT8ajgJ6VTlrBMPB+kjKWzuhdx6pz3vO6Aaem+TEcaW/4tRgsTuLEw+g56wnVx2AUkJgGw4yJ9MKdA7N48gJorISeF5bQXvdgWrtUYiTuoEsvj6kyDvDWpdjcPIW4Af2hl7FS2ASY48lVN41E36Pgc0WvRA9kA6sG1I7yZXXQKKIq2eu8obchr2ozLFjeqmVP8ASlQ== X-YMail-OSG: Yh27HCIVM1lmsqqbZgmt9reafPSEAX7l6EpSEfgG8iCOYafh0__tl72XPEkOvec sSHDmzBNP7u7HWuFO1My1pJMwOKf41eWS0PpKOjrnaP2zEm9jb_uzk9ucZP1MZBL6uF5Eo.4uT9j 5xYrRn8u5N3BTAjeFpby8jQ3WartwmB7cK1HLomC3PLhVeHEGYWncO15O9mB7p5GX.7cnnKNc8bH wSZ7j17S6YqVAJk0yYs5CAP.ckCL4Jg8KMjbRQLI5mfVObtFKLvydeT32dPPL0M0DVZ2d7u_E0o4 94PG9JEARjpIwrqwp3UEL7eJAlYNfK06fsnA2rTLTVCQxXRl.x8GszdYxrOdpydkWvw0iLtUhJ_j rcesD8b6GTjICJJWz5hAOYJsNeXhYogtaPGE4n1kd_ViUi3jeyC6VZ8asKUewrJny5nJ3fagCVyb 5lrHexjuS6gU2WEL1KzqBIbYSZ5zjtstWScHD0nzBvmH4oSAjlXm6qmJKMOFc4wJYG4mPtC6zACA VNhTJY8PBUST4O6vKTxZL.1fepzt6RNrM.daptEox2RbT7zIfqJOKumVRugC6norroq9IoAPxSn0 mi6zXET7zSBoackz8CvgCGQNp9QmT8fNRTf1wbUjjBKBzxTfVjs72ZClUt_qmTylu6IIwCjaL4ZA ViFd8H4ba7KMPnyXB4Dj7_ziR1IDwIu_sIp50qzafQSRNZ4DXQn4BMNLw4M4_nmUS9znEBp6WRfH RsOj0DFhy4eHzcSta4TW6MGlv2I.xQ.ZROWGOWsSx_FiWX3sgRDfq.N2paiRs9s7tGa.d.AD7oiZ 0lATUNJdn49xD84Fz.5yFpC9RGpGRVek8TNY2beuLiNfoPnlCtIkzh5vfU2NNXRbtyOJSwuZ3Y.P hWhlYkNVLxZoDuv19zXBgMqrdMLYS2rkST.KsfPYDalglavduLFyfEwi76cTbeeQh.05WgDrNUlt InoWUUF8D_K1lT7bxJ1D_Q1i9kzHPYn9UV0zsthkiW3JojlYslutdYrWc9mSFZ7xttz.GjzCkSmb mO_gH4LYqike1nO6BHmNFYI8lGMP4xVWamHYSuHc.aYivxVqk0i_8dXI7ozio8b61RJ6AlMF9h4M 6VpO3xpvBmwTc3NOzIsXsnBl.gZq.iwdnE2Dptxi3wDJ6mXFoGYRCiDqurBu9iO3knueQxpTPKdc .HlhiG9B4vtcyOwoKJqMM7nYkwIu9Ou0sF8iWtlLCEjNBx55tkqulkoEfF7pQ8TCE5XT9p3qtHq7 hQBmBEOgUSBJVsXjeE9V8tsK4abXTQiVCkRt6aWk.qxAV5SPIkoXFZk.5.xsg0OpVyUM4jjiKQUx TCe8rObjIvsPQDnkEJCA5NV692wkaIoAcHCyWeXnK_HbLNMMszEImtX8XBLJcmRC9kFKxVyUBKhE 1WIrAPF9wZ2FnKbLXJ5.tGvC.Gug6ATMQQltYArsiFupwC2iSEQ7hS1S_.qwLjLp85zzvTvzEAd0 BC0y3s1y9D_1SuO4iJC8DI3hmydph_xaIpdyaRixyJ3Q5VgR1ZLokLLevpARjedf5aIY9mQxneje CAQTouYkwo1XK1JruZAhBE9ZMpXwBBm1G6vyw82fYIMEpIdDna0.xTJQjTFWY58cjcS9_dBf2LB3 iRevYqAXw9y2oOWqIdxSdd0vRwz2LY6nD_H6jET0ZKDO28SSa0dEYXALGbWyfg4OyoaOz8me5YG1 pZbR7zvNZyKijSGu_7Jtv1VTC03u4Q7_LSR2AFqLs6tKnV1itka.sWDJk0fe9I9usGp6lwFMuflk nVPJnIZaKQLPiGJ5EiM2n2pvJTSlKsKQHudPPL6K0sCz4cMd8hWMfgJflkmFUYwnmsF7d0Bd.7lF deS2aS22wG7WyPxDciL01hpc8RULb33APIjvBMtD6cyOu7NkBAEWFp_ds8BmkupEHM.bbo1NPpkm bZqjyhk2G2NpcH_s9NR64UXfCjjsAVJWnpL6laCI_bgHOGPDhl87SjUepQD0UaaS.1qUoQ2mEADA N4cWAmzXG4qh.99gmH0WahnojZc44BjlPYPdUnHNXeWYJx89dCTuLTKoEORALlyFsavLvIyUwwop SiDDH00B_aCU1vkKL1hclfb_BUk_VfhEqHYP85c.HQsJEaPEdjhZ_vNGus09.zAuOLPGiHRfJ78S EUlgQaULJ2KkQvzs4u5SNPyquOoJ29MH7JVkJuATk_8VgD3Yimra4mlKG9qje.pxGBUp6kud2W57 VEWgcXS3ptmKYVipTi7DxhUoEImKJ_ML2yQvm1GsKP_10Js3cPf9A8s5Z6GjFKQMTH1p1V2aOTj8 xNlPgPWdERuTdwVQWvKGnqt381tc- X-Sonic-MF: X-Sonic-ID: 308d9de0-972d-4455-83d9-7d9858fbfa3e Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Mon, 31 Aug 2026 22:48:27 +0000 Received: by hermes--production-gq1-678d9dd684-vr75x (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 9afda7e456c775b6473ef75f34d3e2be; Mon, 31 Aug 2026 22:38:08 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 6/7] Apparmor: hooks for secctx_to_lsmprop and update_lsmprop Date: Mon, 31 Aug 2026 15:37:47 -0700 Message-ID: <20260831223748.4304-7-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831223748.4304-1-casey@schaufler-ca.com> References: <20260831223748.4304-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Implement these hooks. Signed-off-by: Casey Schaufler --- security/apparmor/include/secid.h | 4 ++++ security/apparmor/lsm.c | 2 ++ security/apparmor/secid.c | 21 +++++++++++++++++++++ 3 files changed, 27 insertions(+) diff --git a/security/apparmor/include/secid.h b/security/apparmor/include/= secid.h index 6025d3849cf8..ba7adf2fc09e 100644 --- a/security/apparmor/include/secid.h +++ b/security/apparmor/include/secid.h @@ -28,6 +28,10 @@ struct aa_label *aa_secid_to_label(u32 secid); int apparmor_secid_to_secctx(u32 secid, struct lsm_context *cp); int apparmor_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *= cp); int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); +int apparmor_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop); +void apparmor_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid); void apparmor_release_secctx(struct lsm_context *cp); =20 =20 diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 88d12e89d115..1f304b88eaf9 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1766,6 +1766,8 @@ static struct security_hook_list apparmor_hooks[] __r= o_after_init =3D { LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx), LSM_HOOK_INIT(lsmprop_to_secctx, apparmor_lsmprop_to_secctx), LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid), + LSM_HOOK_INIT(secctx_to_lsmprop, apparmor_secctx_to_lsmprop), + LSM_HOOK_INIT(update_lsmprop, apparmor_update_lsmprop), LSM_HOOK_INIT(release_secctx, apparmor_release_secctx), =20 #ifdef CONFIG_IO_URING diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index 28caf66b9033..d35fdbf074e0 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -106,6 +106,27 @@ int apparmor_secctx_to_secid(const char *secdata, u32 = seclen, u32 *secid) return 0; } =20 +int apparmor_secctx_to_lsmprop(const char *secdata, u32 seclen, + struct lsm_prop *prop) +{ + struct aa_label *label; + + label =3D aa_label_strn_parse(&root_ns->unconfined->label, secdata, + seclen, GFP_KERNEL, false, false); + if (IS_ERR(label)) + return PTR_ERR(label); + prop->apparmor.label =3D label; + + return 0; +} + +void apparmor_update_lsmprop(struct lsm_prop *dest, struct lsm_prop *src, + int lsmid) +{ + if (lsmid =3D=3D LSM_ID_APPARMOR || lsmid =3D=3D LSM_ID_UNDEF) + dest->apparmor.label =3D src->apparmor.label; +} + void apparmor_release_secctx(struct lsm_context *cp) { if (cp->id =3D=3D LSM_ID_APPARMOR) { --=20 2.54.0 From nobody Sat Sep 26 13:47:01 2026 Received: from sonic314-27.consmr.mail.ne1.yahoo.com (sonic314-27.consmr.mail.ne1.yahoo.com [66.163.189.153]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1A403C10A2 for ; Mon, 31 Aug 2026 22:48:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.163.189.153 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216509; cv=none; b=W8Lf5lhCxiM42kSVOhqyE48p0ccbIiTF9z9yJenxuAtPdtQXgzS2kITvcCjz1q0oSiSvp06keSpDxgnuWwKYhsyrKL1MdGrSl5d5lj2PIobapoGZatpSo6A3d2EowBVFJdNcJ0zE7Q5sJGK4Odhcdc/wWAX0kmVOG0swVaCj0vU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788216509; c=relaxed/simple; bh=3Em4dnMVLjy93H+M96NVDsR9j5BHc56wCz13Hmgs1lI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uiF068NJLH4pQmzDZAseMqmuRHZH3woolUBZGs94GtDAOZVzUK20d4g+IrtyylFFtvyzvP3lE8mkRI2BPWdmpReyd8UgnNzO0/QsUb6xokG2y1cy4nKOR2wLZdGmoecjOyHRws/ERnZ+sGb+MH1deRde8sunX0vmc/M1PXURELU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=SZ47RQrP; arc=none smtp.client-ip=66.163.189.153 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="SZ47RQrP" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216506; bh=Ks8XRiS+k4/39rYJBCyFDwLe73n5LVvsb3STBy6zqzM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject:Reply-To; b=SZ47RQrPAKpXRQWGe31JpvMVtJjfzbY1UryaB0jTyfQhDvBD5+WPgjmhLW5x9blt9r4MiSS9LXZI+OgBmY1runh541eYaD3X6vLowpKWATI1P7NPQ5C2UWBCcAexNdlYiHI7/qM0+FcPwnvKH7LyOIy6/A+W49KPme0NWdE2QFy2NOdDI6J/EdHgP5y70ioTt+g8Wsqax/no6Cvs9L91Fga+gN6i5AvW4PhH+cfTkhg5jlsOn02ZHY3Mybsu669jcquPe+ngy6R7JkXz2O5box04uWQPOwPMwCwKSgtB6mq4jbwQV2zFhIB52ZNeFjnSxtqleOx52ZLIhNcEMr2jgQ== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1788216506; bh=0C3UXawmpNUN+dP8/szCdOx4LwV8Wxf9ni4vL8BQo2n=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=GXAMR0qUDLRvOxyUEVkGzGvql7JEzUnNVf1YkFRpzFlQzyuXMIX6+9etiwOW246Xm3ZUdoDPYRMXctrgiIVFBuSijZ+i6CoHjtXfoPUz0uissNZcSWT7w1E4UDlHDgN/EM2ftjDPaVzCuXdopp5ccdY5aMn48XkMrzsRP2xN4/ie+V17PIRllrXDzKmQA5cYC7WDs2hIXqUUzp4x+s0o1WdHifhf9pcOJD8bUTClsah+tnWvCZONl/tar/259PlaLkV5WPvXIW4J3bA9tzH76f+iUuigaF1JHY3QnNiL7moxOjJn2/8uAb11DiyZrhSM9QZts0J0B0p7GqY1GylR2w== X-YMail-OSG: 4OypUFsVM1my6J1g3aQ1PGQIFwga6sJvSEh.d0VSMBf3gnZGmHoWCRUOMbDyznO D3ZzYxCkaN_SjoY8zC0Lp39tEp0gPhJhe7576tELTjhFcY.7UVPzKCeXqjl3BPqy9gTgwm.Y0J5Z kG5k0FkEXY3BYFoW7oxNnXsIppM4k.xPw_wPODpDxr1flD6Y8vpxIBopGXU8zYKr87UMIEpG_qrI EsWhnRJGwjBVUYVHsasvULtFC7mtVApEhGjeSS5EGBqD6K1qaUvEDLi1T.x6yf5WlCJlSjmW0S7J IYDEhjl7IbojDpF5ZicMg8m2vuN5sbnT_lzJmoJiLi9YVX_FD_.8GXVgcz0OniDiBYVSVDiXhVc4 7_mpKkbK1dcRGg8Qlbi.v_nDN1Z4HxIUOf9MrX1CzSZgFGygvO0gVQwpVY.5xzJiRN_3kvbsibQ. 1cRggTF5yphX5xLz3NOr0ugolbDOdwY5eah1zCa5_rp0enbpOhYgnfAfuvJO1AjEe2YmxglzmdJS ip4_jJ.2CTssn739l2.vqXGNic.jJwAWmMyO3W9r6.mdw8ZcbOeKG2rjB83PG5e6zm0QDlNQo_WK TMkM7is7YNCMFFL7jpfE0KB92UfzFk6bVobFuu99X7kQKPPQzFRgQg9eavvH4.c6YdSqfXu7nQIG KWP.v44Af5AOtb3F5w5Qs7AvC7wPgXHFEJOtpB7blqKn6QzVRrUoHhNcLNtE1ef42qHprcKMf5Wr ok.DO1FyQoqKgOPGB8ky4r7zYR9qdgyr9ywvo1kOKp_1E4cp4lQ5K7Th.5mypc9JKcW_MiN_o_4B kdqeNZWbZ705QqZPH4srP_CWUydrvuifoCLbD9NcaTLOGJusbgJNQ9J_awvApWf9z4lEemw8bKxh 03eOH0yNfDzqz0d_BOJ8tfptm9ohnS8DCWiY_qdZS4Md30jRU5uSl6QQVWpsKiA1AUHaB8t15rwW y.kvUu8MJcy4CfwOzOTg5wYPcs4Bb.5oKDDIrQYKekePDq.o.AjBaFsiwSa0GpIJGyAcZyWI4io6 f46TRTUEYf29dOcEaf31_5CdQcyP7G7aIFomhINsIM8aIGMRYSl.7FeKgUVITNj4UPoC8i29SxG9 1Kn4JO0DLEqJGh8yCEiKtCJApPTvzot7teRCwjR5FkZ2NnWCtwfQlytKLC0CGufTGTCm9TmaZr.s 1KmP.ccOLKsg7tNoX7WGHZFsXZOw6ZS8A2sf_UQPLYp95Q_isaBLLIlEf1LumWoGD29FCGEC1XwV 7GvfeQIlaI28dGAYvVRikxIXOSywqhxNtL92dhfWX32mqbAcgoEzCEyJc5b4S_QLYysB3oRMO67y 9IUqNCv.2jbo4M45.W4KFjFDWs22AK4SETKVVXhnb6D4S81hSuu3jEmTQIhca191xkOvLUGp2Xg8 yM8o.XROtmEUpsQnUmbnk.rCyH6QyYc.4Zu7.74SykjzQ1NYk4btGD6UkKyK3OBtVf_BB5dJ9Nuj wpxeU1oWfQRMrX7jGQ7vt9_HxMttbdqTv6FMyF2KWEPBoev.BbHlod5TtZ_fSTMMjlkgYeW7VZWX 5wjv7AwT0vGzVcsFZZsN7j0vkM9wUMueyEKZ9LqpyojoqmKQl1hfSPhL1aAdHY80u9HUQuFyBtaO qkWhB2Q3pa2IZ9k3wsWsuD61PGRpL5IyvsjWEnGH2OBsyG00xrfIQtoxKTvtwUW_pkiFGAz1LhvF You5DFMkT_BQdZF1rjPlYb0qx02ZzvCGJPn4qH5jk7WeQwYFLADdOnxyTaLXA._i_9g58cVmgwkE G1rvUZ9gkDyvYOxn75nE.tHTCm9QqwCya2teWwc1PnhnoySWOxM4HCHtscnPIGGTruqEa_jp5nLh w.fFs940jmQqpVi53vXZ69pj7yCsx7tezKeoTHGHZWFhgYWtZhut9HO37E0IsazbAoGVktz0XPdr csHb2P5qnFvRMwmfya8Hmr4N64SBgjbqrBhlqWqt4Ko3NyRLrzCfoirpC_V4s.Vu9x7sUZzsogGS cmFD1ejRK39brNT4OP7XUUbIEoisDQkY7e6nU8F.ZMGNCgZKtDd.lAzTR.98falR5w0n7w9I.iMA wgjLWfg6qfF1FHRacVwcxw4bBae.aaBCVL6g5x5QwACxY5TNhsIi_ULSxxvwVuXIvir34UytmPAH xjgvCpr7ToSw.kwJBanTE8WukC5Ia8ZmUS4uA6O_yEOozh5VtA_GlixTtg5pzAyCqhB51t34zxA2 Jo1zIUav.raVdlQRDgWhwY04Yd_aeaKWxlBfYnvpF8I9kXVgJIvqzjf_lkclyIhHwhKLhabyOVp6 sN62G5jWgI8NB.OlDd5IeWXLxF9uUOjw- X-Sonic-MF: X-Sonic-ID: d7c61874-2010-4091-8054-a888ea0b4e8b Received: from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.ne1.yahoo.com with HTTP; Mon, 31 Aug 2026 22:48:26 +0000 Received: by hermes--production-gq1-678d9dd684-vr75x (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 9afda7e456c775b6473ef75f34d3e2be; Mon, 31 Aug 2026 22:38:09 +0000 (UTC) From: Casey Schaufler To: casey@schaufler-ca.com, paul@paul-moore.com, linux-security-module@vger.kernel.org, pablo@netfilter.org, fw@strlen.de, phil@nwl.cc Cc: linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, selinux@vger.kernel.org Subject: [PATCH 7/7] net, lsm: Change skb secmarks to x-array indexes Date: Mon, 31 Aug 2026 15:37:48 -0700 Message-ID: <20260831223748.4304-8-casey@schaufler-ca.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831223748.4304-1-casey@schaufler-ca.com> References: <20260831223748.4304-1-casey@schaufler-ca.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Maintain a xarray of lsm_prop structures which represent the LSM security information passed via skb->secmark. Pass the xarray index of the appropriate lsm_prop (the secxa) instead of an LSM specific secid. Allow multiple LSMs to specify their components in xarray entries, or create new entries as necessary. Change uses of security_secctx_to_secid() to security_secctx_to_lsmprop() in the netfilter and iptables code. Change security_secmark_relabel_packet() to accept an lsm_prop pointer rather than a secid. Change secxa_set_secmark= () to update and create new entries as necessary. Update the SELinux, Smack and AppArmor hooks that use secmarks to expect a secxa xarray index instead of a secid. Signed-off-by: Casey Schaufler --- include/linux/lsm_hook_defs.h | 2 +- include/linux/lsm_secxa.h | 4 +- include/linux/security.h | 4 +- net/netfilter/nfnetlink_queue.c | 12 +++++- net/netfilter/nft_meta.c | 15 ++++--- net/netfilter/xt_SECMARK.c | 16 +++++-- security/apparmor/net.c | 8 +++- security/lsm_secxa.c | 37 +++++++++++++---- security/security.c | 6 +-- security/selinux/hooks.c | 71 +++++++++++++++++++++++++++----- security/smack/smack_lsm.c | 10 ++++- security/smack/smack_netfilter.c | 10 +++-- 12 files changed, 153 insertions(+), 42 deletions(-) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 679c40a8e127..8ecf07e0e3f0 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -371,7 +371,7 @@ LSM_HOOK(void, LSM_RET_VOID, inet_csk_clone, struct soc= k *newsk, const struct request_sock *req) LSM_HOOK(void, LSM_RET_VOID, inet_conn_established, struct sock *sk, struct sk_buff *skb) -LSM_HOOK(int, 0, secmark_relabel_packet, u32 secid) +LSM_HOOK(int, 0, secmark_relabel_packet, struct lsm_prop *prop) LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_inc, void) LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_dec, void) LSM_HOOK(void, LSM_RET_VOID, req_classify_flow, const struct request_sock = *req, diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h index 569c7f242b78..5be9d64e67e4 100644 --- a/include/linux/lsm_secxa.h +++ b/include/linux/lsm_secxa.h @@ -7,11 +7,13 @@ #ifndef __LINUX_LSM_SECXA_H #define __LINUX_LSM_SECXA_H =20 +#include + #ifdef CONFIG_SECURITY =20 struct lsm_prop; =20 -int secxa_from_lsmprop(struct lsm_prop *prop, u32 *secxa); +int secxa_from_lsmprop(struct lsm_prop *prop, u32 *secxa); int secxa_get_lsmprop(struct lsm_prop **pro, u32 secxa); =20 #endif /* CONFIG_SECURITY */ diff --git a/include/linux/security.h b/include/linux/security.h index 19adc19eb9af..ffbd1708065f 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1715,7 +1715,7 @@ void security_inet_csk_clone(struct sock *newsk, const struct request_sock *req); void security_inet_conn_established(struct sock *sk, struct sk_buff *skb); -int security_secmark_relabel_packet(u32 secid); +int security_secmark_relabel_packet(struct lsm_prop *prop); void security_secmark_refcount_inc(void); void security_secmark_refcount_dec(void); int security_tun_dev_alloc_security(void **security); @@ -1898,7 +1898,7 @@ static inline void security_inet_conn_established(str= uct sock *sk, { } =20 -static inline int security_secmark_relabel_packet(u32 secid) +static inline int security_secmark_relabel_packet(struct lsm_prop *prop) { return 0; } diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queu= e.c index b8aaf39cb4d8..ebab037edc6b 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include #include @@ -606,8 +607,15 @@ static int nfqnl_get_sk_secctx(struct sk_buff *skb, st= ruct lsm_context *ctx) { int seclen =3D 0; #if IS_ENABLED(CONFIG_NETWORK_SECMARK) - if (skb->secmark) - seclen =3D security_secid_to_secctx(skb->secmark, ctx); + struct lsm_prop *prop; + int rc; + + if (skb->secmark) { + rc =3D secxa_get_lsmprop(&prop, skb->secmark); + if (rc) + return 0; + seclen =3D security_lsmprop_to_secctx(prop, ctx, LSM_ID_UNDEF); + } #endif return seclen; } diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index bd0f7a0931f4..664191dfa4b2 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -927,21 +927,24 @@ static const struct nla_policy nft_secmark_policy[NFT= A_SECMARK_MAX + 1] =3D { =20 static int nft_secmark_compute_secid(struct nft_secmark *priv) { - u32 tmp_secid =3D 0; + struct lsm_prop tmp_prop; + u32 secxa =3D 0; int err; =20 - err =3D security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &tmp_secid= ); + err =3D security_secctx_to_lsmprop(priv->ctx, strlen(priv->ctx), + &tmp_prop, LSM_ID_UNDEF); if (err) return err; =20 - if (!tmp_secid) - return -ENOENT; + err =3D secxa_from_lsmprop(&tmp_prop, &secxa); + if (err) + return err; =20 - err =3D security_secmark_relabel_packet(tmp_secid); + err =3D security_secmark_relabel_packet(&tmp_prop); if (err) return err; =20 - priv->secid =3D tmp_secid; + priv->secid =3D secxa; return 0; } =20 diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index ea67aa92ddc2..05b023a7c576 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -43,13 +43,15 @@ secmark_tg(struct sk_buff *skb, const struct xt_secmark= _target_info_v1 *info) =20 static int checkentry_lsm(struct xt_secmark_target_info_v1 *info) { + struct lsm_prop prop; int err; =20 info->secctx[SECMARK_SECCTX_MAX - 1] =3D '\0'; info->secid =3D 0; =20 - err =3D security_secctx_to_secid(info->secctx, strlen(info->secctx), - &info->secid); + err =3D security_secctx_to_lsmprop(info->secctx, strlen(info->secctx), + &prop, LSM_ID_UNDEF); + if (err) { if (err =3D=3D -EINVAL) pr_info_ratelimited("invalid security context \'%s\'\n", @@ -57,18 +59,24 @@ static int checkentry_lsm(struct xt_secmark_target_info= _v1 *info) return err; } =20 - if (!info->secid) { + if (!lsmprop_is_set(&prop)) { pr_info_ratelimited("unable to map security context \'%s\'\n", info->secctx); return -ENOENT; } =20 - err =3D security_secmark_relabel_packet(info->secid); + err =3D security_secmark_relabel_packet(&prop); if (err) { pr_info_ratelimited("unable to obtain relabeling permission\n"); return err; } =20 + err =3D secxa_from_lsmprop(&prop, &info->secid); + if (err) { + pr_info_ratelimited("unable to obtain secmark\n"); + return err; + } + security_secmark_refcount_inc(); return 0; } diff --git a/security/apparmor/net.c b/security/apparmor/net.c index cf590dd08540..e26e15c2d947 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -8,6 +8,7 @@ * Copyright 2009-2017 Canonical Ltd. */ =20 +#include #include "include/af_unix.h" #include "include/apparmor.h" #include "include/audit.h" @@ -365,12 +366,17 @@ static int aa_secmark_perm(struct aa_profile *profile= , u32 request, u32 secid, struct apparmor_audit_data *ad) { int i, ret; + struct lsm_prop *prop; struct aa_perms perms =3D { }; struct aa_ruleset *rules =3D profile->label.rules[0]; =20 if (rules->secmark_count =3D=3D 0) return 0; =20 + ret =3D secxa_get_lsmprop(&prop, secid); + if (ret) + return ret; + for (i =3D 0; i < rules->secmark_count; i++) { if (!rules->secmark[i].secid) { ret =3D apparmor_secmark_init(&rules->secmark[i]); @@ -378,7 +384,7 @@ static int aa_secmark_perm(struct aa_profile *profile, = u32 request, u32 secid, return ret; } =20 - if (rules->secmark[i].secid =3D=3D secid || + if (rules->secmark[i].secid =3D=3D prop->apparmor.label->secid || rules->secmark[i].secid =3D=3D AA_SECID_WILDCARD) { if (rules->secmark[i].deny) perms.deny =3D ALL_PERMS_MASK; diff --git a/security/lsm_secxa.c b/security/lsm_secxa.c index 50ce613e35c0..2991aee204df 100644 --- a/security/lsm_secxa.c +++ b/security/lsm_secxa.c @@ -99,7 +104,25 @@ EXPORT_SYMBOL(secxa_from_lsmprop); */ void secxa_set_secmark(struct sk_buff *skb, u32 secxa) { - if (!skb->secmark) + struct lsm_prop *olp; + struct lsm_prop *nlp; + struct lsm_prop prop; + u32 tsecxa; + int rc; + + if (!skb->secmark) { skb->secmark =3D secxa; + return; + } + + olp =3D xa_load(&secxa_xa, skb->secmark); + nlp =3D xa_load(&secxa_xa, secxa); + + prop =3D *olp; + security_update_lsmprop(&prop, nlp, LSM_ID_UNDEF); + + rc =3D secxa_from_lsmprop(&prop, &tsecxa); + if (!rc) + skb->secmark =3D tsecxa; } EXPORT_SYMBOL(secxa_set_secmark); diff --git a/security/security.c b/security/security.c index 1dec0037370b..e80e7823ce14 100644 --- a/security/security.c +++ b/security/security.c @@ -4646,15 +4646,15 @@ EXPORT_SYMBOL(security_inet_conn_established); =20 /** * security_secmark_relabel_packet() - Check if setting a secmark is allow= ed - * @secid: new secmark value + * @lsmprop: new secmark value * * Check if the process should be allowed to relabel packets to @secid. * * Return: Returns 0 if permission is granted. */ -int security_secmark_relabel_packet(u32 secid) +int security_secmark_relabel_packet(struct lsm_prop *prop) { - return call_int_hook(secmark_relabel_packet, secid); + return call_int_hook(secmark_relabel_packet, prop); } EXPORT_SYMBOL(security_secmark_relabel_packet); =20 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 12614478b638..bf832eff0b92 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -94,6 +94,7 @@ #include #include #include +#include =20 #include "initcalls.h" #include "avc.h" @@ -5414,7 +5415,16 @@ static int selinux_sock_rcv_skb_compat(struct sock *= sk, struct sk_buff *skb, return err; =20 if (selinux_secmark_enabled()) { - err =3D avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, + struct lsm_prop *prop; + u32 secmark =3D 0; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + + err =3D avc_has_perm(sk_sid, secmark, SECCLASS_PACKET, PACKET__RECV, &ad); if (err) return err; @@ -5483,7 +5493,15 @@ static int selinux_socket_sock_rcv_skb(struct sock *= sk, struct sk_buff *skb) } =20 if (secmark_active) { - err =3D avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET, + struct lsm_prop *prop; + u32 secmark =3D 0; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + err =3D avc_has_perm(sk_sid, secmark, SECCLASS_PACKET, PACKET__RECV, &ad); if (err) return err; @@ -5885,10 +5903,10 @@ static void selinux_inet_conn_established(struct so= ck *sk, struct sk_buff *skb) selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid); } =20 -static int selinux_secmark_relabel_packet(u32 sid) +static int selinux_secmark_relabel_packet(struct lsm_prop *lsmprop) { - return avc_has_perm(current_sid(), sid, SECCLASS_PACKET, PACKET__RELABELT= O, - NULL); + return avc_has_perm(current_sid(), lsmprop->selinux.secid, + SECCLASS_PACKET, PACKET__RELABELTO, NULL); } =20 static void selinux_secmark_refcount_inc(void) @@ -6016,10 +6034,21 @@ static unsigned int selinux_ip_forward(void *priv, = struct sk_buff *skb, } } =20 - if (secmark_active) - if (avc_has_perm(peer_sid, skb->secmark, + if (secmark_active) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + + if (avc_has_perm(peer_sid, secmark, SECCLASS_PACKET, PACKET__FORWARD_IN, &ad)) return NF_DROP; + } =20 if (netlbl_enabled()) /* we do this in the FORWARD path and not the POST_ROUTING @@ -6093,10 +6122,20 @@ static unsigned int selinux_ip_postroute_compat(str= uct sk_buff *skb, if (selinux_parse_skb(skb, &ad, NULL, 0, &proto)) return NF_DROP; =20 - if (selinux_secmark_enabled()) - if (avc_has_perm(sksec->sid, skb->secmark, + if (selinux_secmark_enabled()) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + if (avc_has_perm(sksec->sid, secmark, SECCLASS_PACKET, PACKET__SEND, &ad)) return NF_DROP_ERR(-ECONNREFUSED); + } =20 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) return NF_DROP_ERR(-ECONNREFUSED); @@ -6215,10 +6254,20 @@ static unsigned int selinux_ip_postroute(void *priv, if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL)) return NF_DROP; =20 - if (secmark_active) - if (avc_has_perm(peer_sid, skb->secmark, + if (secmark_active) { + struct lsm_prop *prop; + u32 secmark =3D 0; + int err; + + if (skb->secmark) { + err =3D secxa_get_lsmprop(&prop, skb->secmark); + if (!err) + secmark =3D prop->selinux.secid; + } + if (avc_has_perm(peer_sid, secmark, SECCLASS_PACKET, secmark_perm, &ad)) return NF_DROP_ERR(-ECONNREFUSED); + } =20 if (peerlbl_active) { u32 if_sid; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index fcfadd5d9994..79140e6829a4 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -42,6 +42,7 @@ #include #include #include +#include #include #include #include "smack.h" @@ -4189,10 +4190,17 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb= , struct sockaddr_in6 *sip) #ifdef CONFIG_NETWORK_SECMARK static struct smack_known *smack_from_skb(struct sk_buff *skb) { + struct lsm_prop *prop; + int rc; + if (skb =3D=3D NULL || skb->secmark =3D=3D 0) return NULL; =20 - return smack_from_secid(skb->secmark); + rc =3D secxa_get_lsmprop(&prop, skb->secmark); + if (prop) + return prop->smack.skp; + + return NULL; } #else static inline struct smack_known *smack_from_skb(struct sk_buff *skb) diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfil= ter.c index b363c42f252e..0378f74aa22b 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -24,13 +24,17 @@ static unsigned int smack_ip_output(void *priv, const struct nf_hook_state *state) { struct sock *sk =3D skb_to_full_sk(skb); + struct lsm_prop prop =3D { }; struct socket_smack *ssp; - struct smack_known *skp; + u32 secxa; + int rc; =20 if (sk) { ssp =3D smack_sock(sk); - skp =3D ssp->smk_out; - secxa_set_secmark(skb, skp->smk_secid); + prop.smack.skp =3D ssp->smk_out; + rc =3D secxa_from_lsmprop(&prop, &secxa); + if (!rc) + secxa_set_secmark(skb, secxa); } =20 return NF_ACCEPT; --=20 2.54.0